GNOME Bugzilla – Bug 764014
Gnome-keyring stores plaintext passwords in memory
Last modified: 2021-06-18 10:41:13 UTC
gnome-keyring stores copies of login passwords in memory as strings. It's possible to retrieve passwords via ptrace() and dump, /proc, /mem methods. Reproduce: sudo gcore $(pgrep gnome-keyring) strings core.$pid Possible alternative: 1. hash the password, store the hash in memory. 2. user login, challenged for password, hash and compare with stored hash. 3. allow or deny based on match.
Agreed. It would make sense to change this situation. Are you interested in contributing changes? We could work out how to get to one of the alternatives.
Interested in contributing to a solution here. Unfamiliar with the key parts of the codebase for gnome-keyring which would have to be modified. Any pointers to key functions for gnome-keyring-daemon? PBKDF2 or bcrypt with per user salts would be possible, both have work factors that can be adjusted to make brute force harder. Both would add dependencies. What about crypt() with id = 6? (SHA-512 + salt). This is debian's default password storage for /etc/shadow.
Sorry for the delay responding. In my opinion the goal should be to remain compatible with previously encrypted keyrings, and not introduce a new format at this point. The key part of the code is in encrypt_buffer() in gnome-keyring/pkcs11/secret-store/gkm-secret-binary.c. Instead of running egg_symkey_generate_simple() during encrypt_buffer() we should run it when decrypting the keyring and keep the resulting symkey in memory until needed for encryption. In addition in the code in gkm_secret_binary_write() when rewriting a keyring, we should choose to use a hash_iterations of the previously decrypted keyring. What do you think?
GNOME is going to shut down bugzilla.gnome.org in favor of gitlab.gnome.org. As part of that, we are mass-closing older open tickets in bugzilla.gnome.org which have not seen updates for a longer time (resources are unfortunately quite limited so not every ticket can get handled). If you can still reproduce the situation described in this ticket in a recent and supported software version, then please follow https://wiki.gnome.org/GettingInTouch/BugReportingGuidelines and create a new ticket at https://gitlab.gnome.org/GNOME/gnome-keyring/-/issues/ Thank you for your understanding and your help.